{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T18:04:42Z","timestamp":1775066682275,"version":"3.50.1"},"reference-count":37,"publisher":"International Association for Cryptologic Research","issue":"2","license":[{"start":{"date-parts":[[2025,1,14]],"date-time":"2025-01-14T00:00:00Z","timestamp":1736812800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2025,6,2]]},"abstract":"<jats:p>All RLWE-based FHE schemes are inherently noisy. The CKKS scheme (Cheon, Kim, Kim, Song, Asiacrypt 2017) considers the noise as a part of the message, yielding approximate computations but also considerable performance gains. Since it grows with each homomorphic operation and incurs a precision loss, it is paramount for users to be able to estimate the noise level throughout a given circuit in order to appropriately estimate parameters and control the precision loss in the message. In this work, we develop a noise model that allows for tight estimates of the precision loss, and propose a tool prototype for computing these estimates on any given circuit. Our noise model relies on a novel definition, the component-wise noise, which makes the average-case noise estimates tighter and more composable. As a result, our model and tool can derive accurate estimates of complex circuits such as bootstrapping. We experimentally demonstrate the tightness of our noise estimates by showing that our theoretical estimates never deviate by more than 0.01 bits from experimental estimates, even for large circuits, and hold with high probability. Furthermore, we demonstrate how to apply our techniques to obtain an exact version of the CKKS scheme in which the decryption removes all the noise (with high probability). Such a scheme has many applications, as it allows to take advantage of the efficiency of CKKS, while preserving an exact message space, hence further strengthening CKKS against IND-CPA-D attacks. <\/jats:p>","DOI":"10.62056\/a3n5tx4e-","type":"journal-article","created":{"date-parts":[[2025,7,7]],"date-time":"2025-07-07T21:09:09Z","timestamp":1751922549000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":3,"title":["Accurate and Composable Noise Estimates for CKKS with Application to Exact HE Computation"],"prefix":"10.62056","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2020-0224","authenticated-orcid":false,"given":"Jean-Philippe","family":"Bossuat","sequence":"first","affiliation":[{"name":"Gauss Labs Pte. Ltd.","place":["Singapore"]},{"name":"Tune Insight SA","place":["Lausanne, Switzerland"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8793-6116","authenticated-orcid":false,"given":"Anamaria","family":"Costache","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/05xg72x27","id-type":"ROR","asserted-by":"publisher"}],"name":"Norwegian University of Science and Technology \u2013 NTNU","place":["Trondheim, Norway"],"department":["Information Security and Communication Technology"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5686-9459","authenticated-orcid":false,"given":"Christian","family":"Mouchet","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/058rn5r42","id-type":"ROR","asserted-by":"publisher"}],"name":"Hasso Plattner Institute","place":["Potsdam, Germany"],"department":["University of Potsdam"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9074-1993","authenticated-orcid":false,"given":"Lea","family":"N\u00fcrnberger","sequence":"additional","affiliation":[{"id":[{"id":"https:\/\/ror.org\/05xg72x27","id-type":"ROR","asserted-by":"publisher"}],"name":"Norwegian University of Science and Technology \u2013 NTNU","place":["Trondheim, Norway"],"department":["Information Security and Communication Technology"]}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8764-5570","authenticated-orcid":false,"given":"Juan","family":"Troncoso-Pastoriza","sequence":"additional","affiliation":[{"name":"Tune Insight SA","place":["Lausanne, Switzerland"]}]}],"member":"48349","published-online":{"date-parts":[[2025,7,7]]},"reference":[{"key":"ref1:ITCS:BGV12","series-title":"ITCS '12","doi-asserted-by":"publisher","DOI":"10.1145\/2090236.2090262","article-title":"(Leveled) Fully Homomorphic Encryption without\n  Bootstrapping","author":"Zvika Brakerski","year":"2012"},{"key":"ref2:AC:CKKS17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70694-8_15","article-title":"Homomorphic Encryption for Arithmetic of Approximate\n  Numbers","author":"Jung Hee Cheon","year":"2017"},{"key":"ref3:JC:CGGI20","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-019-09319-x","article-title":"TFHE: Fast Fully Homomorphic Encryption Over the Torus","volume":"33","author":"Ilaria Chillotti","year":"2020","journal-title":"J. Cryptol."},{"key":"ref4:EC:DucMic15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-46800-5_24","article-title":"FHEW: Bootstrapping Homomorphic Encryption in Less Than a\n  Second","author":"L\u00e9o Ducas","year":"2015"},{"key":"ref5:EPRINT:FanVer12","volume-title":"Somewhat Practical Fully Homomorphic Encryption","author":"Junfeng Fan","year":"2012"},{"key":"ref6:C:GSW13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40041-4_5","article-title":"Homomorphic Encryption from Learning with Errors:\n  Conceptually-Simpler, Asymptotically-Faster, Attribute-Based","author":"Craig Gentry","year":"2013"},{"key":"ref7:JACM:Regev09","doi-asserted-by":"publisher","DOI":"10.1145\/1568318.1568324","article-title":"On lattices, learning with errors, random linear codes, and\n  cryptography","volume":"56","author":"Oded Regev","year":"2009","journal-title":"J. ACM"},{"key":"ref8:EC:LiMic21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-77870-5_23","article-title":"On the Security of Homomorphic Encryption on Approximate\n  Numbers","author":"Baiyu Li","year":"2021"},{"key":"ref9:lib:lattigo","volume-title":"Lattigo v6","author":"Lattigo","year":"2024"},{"key":"ref10:EPRINT:CCHMOP22v1","volume-title":"On the precision loss in approximate homomorphic\n  encryption","author":"Anamaria Costache","year":"2022"},{"key":"ref11:SAC:CCHMOP23","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1007\/978-3-031-53368-6_16","article-title":"On the precision loss in approximate homomorphic\n  encryption","author":"Anamaria Costache","year":"2023"},{"key":"ref12:CT-RSA:CNP23","doi-asserted-by":"publisher","first-page":"29","DOI":"10.1007\/978-3-031-30872-7_2","article-title":"Optimisations and Tradeoffs for HElib","author":"Anamaria Costache","year":"2023"},{"key":"ref13:EPRINT:BMCM23","volume-title":"Improving and Automating BFV Parameters Selection: An\n  Average-Case Approach","author":"Beatrice Biasioli","year":"2023"},{"key":"ref14:CIC:MurPla24","doi-asserted-by":"publisher","DOI":"10.62056\/ay76c0kr","article-title":"A central limit approach for Ring-LWE noise analysis","volume":"1","author":"Sean Murphy","year":"2024","journal-title":"IACR Communications in Cryptology"},{"key":"ref15:SAC:CHKKS18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-10970-7_16","article-title":"A Full RNS Variant of Approximate Homomorphic Encryption","author":"Jung Hee Cheon","year":"2019"},{"key":"ref16:JC:DMPS24","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-023-09483-1","article-title":"BLEACH: Cleaning Errors in Discrete Computations","author":"N. Drucker","year":"2024","journal-title":"Journal of Cryptology"},{"key":"ref17:EC:BCKS24","doi-asserted-by":"publisher","first-page":"94","DOI":"10.1007\/978-3-031-58723-8_4","article-title":"Bootstrapping Bits with CKKS","author":"Youngjin Bae","year":"2024"},{"key":"ref18:AC:BKSS24","doi-asserted-by":"publisher","first-page":"330","DOI":"10.1007\/978-981-96-0875-1_11","article-title":"Bootstrapping small integers with CKKS","author":"Youngjin Bae","year":"2025"},{"key":"ref19:EPRINT:AleKimPol24","volume-title":"General Functional Bootstrapping using CKKS","author":"Andreea Alexandru","year":"2024"},{"key":"ref20:EPRINT:GaoZhe25","volume-title":"A Critique on Average-Case Noise Analysis in RLWE-Based\n  Homomorphic Encryption","author":"Mingyu Gao","year":"2025"},{"key":"ref21:Kim2025","volume-title":"Efficient Homomorphic Integer Computer from CKKS","author":"Jaehyung Kim","year":"2025"},{"key":"ref22:PKC:BCDHLT","doi-asserted-by":"publisher","first-page":"102","DOI":"10.1007\/978-3-031-91832-2_4","article-title":"Revisiting the security of approximate FHE with\n  noise-flooding countermeasures","author":"Flavio Bergamaschi","year":"2025"},{"key":"ref23:RSA:CosSma16","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1007\/978-3-319-29485-8_19","article-title":"Which ring based somewhat homomorphic encryption scheme is\n  best?","author":"Ana Costache","year":"2016"},{"key":"ref24:ESORICS:CosLaiPla20","doi-asserted-by":"publisher","first-page":"546","DOI":"10.1007\/978-3-030-59013-0_27","article-title":"Evaluating the Effectiveness of Heuristic Worst-Case Noise\n  Analysis in FHE","author":"Anamaria Costache","year":"2020"},{"key":"ref25:EC:BMTH21","doi-asserted-by":"publisher","first-page":"587","DOI":"10.1007\/978-3-030-77870-5_21","article-title":"Efficient Bootstrapping for Approximate Homomorphic\n  Encryption with Non-sparse Keys","author":"Jean-Philippe Bossuat","year":"2021"},{"key":"ref26:ACNS:BTH22","isbn-type":"print","doi-asserted-by":"publisher","first-page":"521","DOI":"10.1007\/978-3-031-09234-3_26","article-title":"Bootstrapping for\u00a0Approximate Homomorphic Encryption\n  with\u00a0Negligible Failure-Probability by\u00a0Using Sparse-Secret Encapsulation","author":"Jean-Philippe Bossuat","year":"2022","ISBN":"https:\/\/id.crossref.org\/isbn\/9783031092343"},{"key":"ref27:Iliashenko","volume-title":"Optimisations of Fully Homomorphic Encryption","author":"Ilia Iliashenko","year":"2019"},{"key":"ref28:EC:CCS19","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-17656-3_2","article-title":"Improved Bootstrapping for Approximate Homomorphic\n  Encryption","author":"Hao Chen","year":"2019"},{"key":"ref29:EC:CHKKS18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-78381-9_14","article-title":"Bootstrapping for Approximate Homomorphic Encryption","author":"Jung Hee Cheon","year":"2018"},{"key":"ref30:CT-RSA:HanKi20","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-40186-3_16","article-title":"Better Bootstrapping for Approximate Homomorphic\n  Encryption","author":"Kyoohyung Han","year":"2020"},{"key":"ref31:EC:LLKKN22","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-06944-4_19","article-title":"High-Precision Bootstrapping for Approximate Homomorphic\n  Encryption by Error Variance Minimization","author":"Yongwoo Lee","year":"2022"},{"key":"ref32:EPRINT:CHH18","volume-title":"Faster Homomorphic Discrete Fourier Transforms and\n  Improved FHE Bootstrapping","author":"Jung Hee Cheon","year":"2018"},{"key":"ref33:EC:LLLKN21","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-77870-5_22","article-title":"High-Precision Bootstrapping of RNS-CKKS Homomorphic\n  Encryption Using Optimal Minimax Polynomial Approximation and Inverse Sine\n  Function","author":"Joon-Woo Lee","year":"2021"},{"key":"ref34:EPRINT:LLKN20","doi-asserted-by":"publisher","first-page":"144321","DOI":"10.1109\/ACCESS.2020.3014369","article-title":"Near-optimal polynomial for modulus reduction using\n  L2-norm for approximate homomorphic encryption","volume":"8","author":"Yongwoo Lee","year":"2020","journal-title":"IEEE Access"},{"key":"ref35:EPRINT:JutMan20","volume-title":"Modular Lagrange Interpolation of the Mod Function for\n  Bootstrapping of Approximate HE","author":"Charanjit S. Jutla","year":"2020"},{"key":"ref36:EC:JM22","doi-asserted-by":"publisher","first-page":"491","DOI":"10.1007\/978-3-031-06944-4_17","article-title":"Sine series approximation of the mod function for\n  bootstrapping of approximate HE","author":"Charanjit S Jutla","year":"2022"},{"key":"ref37:AC:KPKKM22","doi-asserted-by":"publisher","first-page":"161","DOI":"10.1007\/978-3-031-22966-4_6","article-title":"EvalRound algorithm in CKKS bootstrapping","author":"Seonghak Kim","year":"2022"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2025,7,7]],"date-time":"2025-07-07T21:09:28Z","timestamp":1751922568000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/2\/2\/8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,7]]},"references-count":37,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2025,7,7]]}},"URL":"https:\/\/doi.org\/10.62056\/a3n5tx4e-","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,7]]},"assertion":[{"value":"2025-01-14","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-06-02","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc2-1-72"}}